@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/systems-of-record/system-of-record-facet.shared.schemas.d.ts

@@ -0,0 +1,478 @@
+/**
+ * `SystemOfRecordVendorFacet` — what a VENDOR is, as a system of record.
+ *
+ * Four concepts carry one job each in this lane (#1049 §4.1, #1055): the **external-data lane** (the
+ * engine runtime), a **dialect adapter** (how to speak — `HttpApiTransportDialect`), a **vendor
+ * facet** (this module: what the vendor needs to be addressed and believed), and a **system of
+ * record** — a named, declared INSTANCE that resources bind by name.
+ *
+ * ## What a facet is NOT
+ *
+ * It is not a provider. A provider is selected through a capability plane, may carry a person's
+ * lent credential, and has an operation catalogue; a system of record is a named deployment the
+ * application reads its own business rows out of, spending its own service identity (D10, D12).
+ * Nothing in this module may reach the provider registry, and the reverse import is what
+ * `pnpm check:systems-of-record-separation` refuses.
+ *
+ * It is also not an INSTANCE. The facet says "an Odoo needs a base URL, a database and a login, and
+ * offers the in-args API-key credential"; it never says WHICH Odoo. Two instances of one vendor
+ * (`odoo-fr`, `odoo-de`) share this facet and differ only in their addresses and secrets — which is
+ * the whole reason the instance is a separate concept from the vendor.
+ *
+ * ## Why this lives in `@wildo-ai/saas-models/external-data` (#1055 R2)
+ *
+ * The obvious home looks like `external-connectors-models`, beside the provider contracts. It
+ * cannot be: that package depends only on `zod-decorators` and its own header forbids reaching
+ * saas-models, while a facet is typed against `HttpApiTransportDialect`, which lives here. It is
+ * also not `ProviderMetadata`-shaped, which is bundle-fenced. So the facet sits beside the binding
+ * schema it serves, on the subpath whose two audiences — the app author and the backend — are
+ * exactly the audiences a facet has.
+ *
+ * Note the split with the two VOCABULARIES it names: `HttpApiTransportDialect` and
+ * `SystemOfRecordCredentialKind` are root-exported boundary modules, because the root-exported
+ * `systemsOfRecord` declaration names them. The SHAPES here are subpath-only, because nothing
+ * root-exported names a slot.
+ *
+ * ## Slots, and why their slugs are lowerCamelCase with nothing else in them
+ *
+ * A slot's slug becomes half of a derived environment-variable name, `WILDO_SOR_<NAME>__<SLOT>`
+ * (#1055 R4). The instance name admits `-` and the slug admits neither `-` nor `_`, so the DOUBLE
+ * underscore between them is a delimiter neither half can produce: the pair is recoverable from
+ * the variable name, and `odoo-api` + `key` can never collide with `odoo` + `apiKey`. That property
+ * is the reason for the regex, so widening it would silently reintroduce the collision.
+ *
+ * ## Partitioning LANDED in #1058, and was held back until it had a reader
+ *
+ * The facet is the single partition authority — which remote field carries the tenant, how it is
+ * encoded — and that vocabulary arrived with the slice that first READS it. It is `partition`
+ * below, and the INSTANCE-side opt-in is now honoured rather than refused at declaration.
+ *
+ * It was withheld until then on purpose, and the reasoning is kept because it is the general rule:
+ * shipping a four-member vocabulary with no reader is the "declared surface with nothing behind
+ * it" shape this repository keeps paying for. It landed additively, as an OPTIONAL field, so every
+ * facet written against the earlier shape still parses.
+ */
+import '@wildo-ai/zod-decorators';
+import { z } from 'zod';
+import { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared';
+import { HttpApiKeyComponentCodec } from '../http-api-binding/http-api-binding.shared.schemas';
+import { SystemOfRecordCredentialKind } from './system-of-record-credential-kind.shared';
+/** @wildo_source:part:start saas.models.systems-of-record facet:layer:shared facet:audience:app-developer */
+/**
+ * One input an instance must supply — an address slot (non-secret, authored in the infra env
+ * config) or a secret slot (authored in `secrets.json`). Both halves share this shape because both
+ * derive an environment-variable name the same way; what differs is WHERE the value is authored and
+ * whether it is ever printed.
+ */
+export declare const SystemOfRecordSlotSchema: z.ZodObject<{
+    /**
+     * lowerCamelCase, and nothing else — see the module header. Becomes the `<SLOT>` half of
+     * `WILDO_SOR_<NAME>__<SLOT>` by upper-snake-casing.
+     */
+    slug: z.ZodString;
+    /**
+     * Whether an instance MUST supply it. A missing required slot refuses at `wildo config sync` and
+     * again at boot (#1055 E4) — the remedy is authoring a value, which needs no running companion,
+     * so refusing is legitimate there.
+     */
+    required: z.ZodBoolean;
+    /** What an operator must put in it. Printed by sync and by the secrets report. */
+    description: z.ZodString;
+}, z.core.$strict>;
+export type SystemOfRecordSlot = z.infer<typeof SystemOfRecordSlotSchema>;
+/**
+ * What ONE credential kind needs, independent of vendor (#1055 R15).
+ *
+ * The kind owns its secrets and any address slot that exists only because the kind was chosen — a
+ * future `OAUTH2_CLIENT_CREDENTIALS` owns `tokenUrl`, which no vendor would declare if it were
+ * reached with a static key. `ODOO_API_KEY_IN_ARGS` needs no address slot of its own, and that is
+ * the seam rather than an omission: its `database` and `login` inputs identify WHICH Odoo and WHICH
+ * user, so they belong to the vendor and would survive a second Odoo credential kind.
+ */
+export declare const SystemOfRecordCredentialKindContractSchema: z.ZodObject<{
+    addressSlots: z.ZodArray<z.ZodObject<{
+        /**
+         * lowerCamelCase, and nothing else — see the module header. Becomes the `<SLOT>` half of
+         * `WILDO_SOR_<NAME>__<SLOT>` by upper-snake-casing.
+         */
+        slug: z.ZodString;
+        /**
+         * Whether an instance MUST supply it. A missing required slot refuses at `wildo config sync` and
+         * again at boot (#1055 E4) — the remedy is authoring a value, which needs no running companion,
+         * so refusing is legitimate there.
+         */
+        required: z.ZodBoolean;
+        /** What an operator must put in it. Printed by sync and by the secrets report. */
+        description: z.ZodString;
+    }, z.core.$strict>>;
+    secretSlots: z.ZodArray<z.ZodObject<{
+        /**
+         * lowerCamelCase, and nothing else — see the module header. Becomes the `<SLOT>` half of
+         * `WILDO_SOR_<NAME>__<SLOT>` by upper-snake-casing.
+         */
+        slug: z.ZodString;
+        /**
+         * Whether an instance MUST supply it. A missing required slot refuses at `wildo config sync` and
+         * again at boot (#1055 E4) — the remedy is authoring a value, which needs no running companion,
+         * so refusing is legitimate there.
+         */
+        required: z.ZodBoolean;
+        /** What an operator must put in it. Printed by sync and by the secrets report. */
+        description: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type SystemOfRecordCredentialKindContract = z.infer<typeof SystemOfRecordCredentialKindContractSchema>;
+/**
+ * Every credential kind's inputs. Engine-owned and CLOSED, keyed by the enum so a member added
+ * without a contract is a compile error rather than a boot surprise.
+ *
+ * ## Which half a slot lands in, since the answer is not "is it secret"
+ *
+ * The split follows the precedent #1055 set with Odoo's `login`: **an identity slot is an ADDRESS
+ * slot and a proof slot is a SECRET slot.** A `clientId` and a BASIC `username` are not
+ * confidential — they name WHICH client and WHICH user — and putting them in `secrets.json` would
+ * hide, from every diff and every environment review, the one thing an operator most often needs to
+ * check. What must never be printed is the half that PROVES the identity.
+ *
+ * The consequence is that a credential's two halves are authored in two files. That is deliberate
+ * and it is the same shape Odoo already has (`login` in the infra config, `apiKey` in the secrets),
+ * so an operator meets one convention rather than two.
+ *
+ * ## Required-ness that a static list cannot express
+ *
+ * Three slots are declared `required: false` here and are made required by the FACET's offer, which
+ * is the only place that knows: `certificateKeyId` when the vendor's assertion header policy is
+ * {@link SystemOfRecordAssertionHeaderPolicy.KEY_ID_SUPPLIED}, `certificatePem` when it is
+ * `X509_THUMBPRINT_DERIVED`, and `subject` for the JWT-bearer grant's `sub`. The join is performed
+ * ONCE, in {@link resolveSystemOfRecordInstanceSlots}, rather than by each of the five readers of
+ * "what does this instance need" — which is the enumeration failure
+ * `invariant-call-site-enumeration.md` exists to stop.
+ */
+export declare const SYSTEM_OF_RECORD_CREDENTIAL_KIND_CONTRACTS: Readonly<Record<SystemOfRecordCredentialKind, SystemOfRecordCredentialKindContract>>;
+/**
+ * How a vendor wants a client assertion's PROTECTED HEADER built (#1056 R2).
+ *
+ * A generic "sign it with the private key" is rejected by both vendors that want an assertion, and
+ * they want DIFFERENT things — which is why this is a facet policy rather than an engine constant.
+ */
+export declare enum SystemOfRecordAssertionHeaderPolicy {
+    /** `kid` carries a key id the VENDOR assigned when the certificate was uploaded (NetSuite). */
+    KEY_ID_SUPPLIED = "key-id-supplied",
+    /**
+     * `x5t` carries the base64url SHA-1 thumbprint of the certificate, DERIVED by the engine from the
+     * supplied `certificatePem` (Microsoft Entra's certificate credential).
+     *
+     * SHA-1 is not a security choice here: `x5t` is defined as a SHA-1 thumbprint (RFC 7515 §4.1.7)
+     * and is an identifier for locating a key, never an integrity proof.
+     * spec-cite: RFC 7515 §4.1.7 ("x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter).
+     */
+    X509_THUMBPRINT_DERIVED = "x509-thumbprint-derived"
+}
+/**
+ * Where a client's id and secret travel on a client-credentials token request.
+ *
+ * RFC 6749 §2.3.1 permits BOTH and says a server MUST support the Basic header while it MAY support
+ * the body form — and real vendors differ, so the choice cannot be an engine default.
+ * spec-cite: RFC 6749 §2.3.1 (Client Password).
+ */
+export declare enum SystemOfRecordClientAuthenticationPlacement {
+    /** `client_id` and `client_secret` as form fields in the request body. */
+    REQUEST_BODY = "request-body",
+    /** `Authorization: Basic base64(client_id ":" client_secret)`. */
+    BASIC_HEADER = "basic-header"
+}
+/**
+ * The algorithms an assertion may be signed with. Asymmetric ONLY, and that is the point: a
+ * symmetric `HS*` assertion is signed with a shared secret, which makes the assertion no stronger
+ * than the secret it was supposed to replace, and `none` is not an algorithm.
+ */
+export declare enum SystemOfRecordAssertionSigningAlgorithm {
+    RS256 = "RS256",
+    RS384 = "RS384",
+    RS512 = "RS512",
+    PS256 = "PS256",
+    ES256 = "ES256",
+    ES384 = "ES384",
+    ES512 = "ES512"
+}
+/**
+ * ONE credential kind as ONE vendor offers it — the kind, plus everything about it that varies by
+ * VENDOR and not by deployment.
+ *
+ * A discriminated union rather than a kind list beside a policy map, so a policy cannot exist
+ * without its kind and a kind cannot be offered without the policy it needs. `API_KEY_HEADER` with
+ * no header name is unrepresentable here; under a parallel map it would parse and fail at the first
+ * read.
+ */
+export declare const SystemOfRecordCredentialOfferSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS>>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.API_KEY_HEADER>>;
+    /** The header the key travels in — `Authorization`, `X-API-Key`, `apikey`, whatever the vendor reads. */
+    headerName: z.ZodString;
+    /** What precedes the key in the header value, INCLUDING its trailing space (`"Bearer "`). Omitted when the key stands alone. */
+    valuePrefix: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.API_KEY_QUERY>>;
+    /** The query parameter the key is appended as. */
+    parameterName: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.BASIC>>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET>>;
+    clientAuthentication: z.ZodEnum<typeof SystemOfRecordClientAuthenticationPlacement>;
+    tokenLifetimeFallbackSeconds: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE>>;
+    assertionHeaderPolicy: z.ZodEnum<typeof SystemOfRecordAssertionHeaderPolicy>;
+    assertionSigningAlgorithm: z.ZodEnum<typeof SystemOfRecordAssertionSigningAlgorithm>;
+    /** How long the ASSERTION is valid — minutes, not hours; it is consumed once at the token endpoint. */
+    assertionLifetimeSeconds: z.ZodNumber;
+    tokenLifetimeFallbackSeconds: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER>>;
+    assertionSigningAlgorithm: z.ZodEnum<typeof SystemOfRecordAssertionSigningAlgorithm>;
+    assertionLifetimeSeconds: z.ZodNumber;
+    tokenLifetimeFallbackSeconds: z.ZodNumber;
+}, z.core.$strict>], "kind">;
+export type SystemOfRecordCredentialOffer = z.infer<typeof SystemOfRecordCredentialOfferSchema>;
+/**
+ * How a vendor's OData service pages a COLLECTION READ (#1292).
+ *
+ * A vendor property rather than a dialect constant, and the reason is one large implementation: the
+ * Microsoft Dataverse Web API refuses `$skip` outright, while OData v4 defines it and a conformant
+ * service serves it. A per-dialect default would have to be wrong for one of them — the same
+ * argument #1056 R3 settled for the token-lifetime fallback.
+ *
+ * spec-cite: OData Version 4.01 Part 1: Protocol §11.2.6 ("$top and $skip") for the default; Microsoft
+ * Learn, "Query data using the Web API"
+ * (https://learn.microsoft.com/en-us/power-apps/developer/data-platform/webapi/query-data-web-api) for
+ * the refusal — that page enumerates the query options the Web API does not support.
+ */
+export declare enum SystemOfRecordODataListPaging {
+    /**
+     * `$top` + `$skip` — one request for any page, which is what a page-numbered contract wants.
+     *
+     * The default, because it is what OData v4 defines and what an uncatalogued service serves.
+     */
+    SKIP = "skip",
+    /**
+     * `@odata.nextLink` only: the service hands back a continuation URL and refuses to be addressed by
+     * offset.
+     *
+     * The consequence is structural rather than a detail — a cursor has no page NUMBER, so page N costs
+     * N requests. The engine walks forward and refuses past a bound rather than pretending otherwise.
+     */
+    NEXT_LINK_ONLY = "next-link-only"
+}
+/**
+ * HOW a vendor partitions the data one deployment holds (#1058).
+ *
+ * Inside ONE corporate, a system of record usually holds several partitions — Odoo companies, SAP
+ * company codes, Dynamics business units, NetSuite subsidiaries. They are not tenants: they all
+ * belong to the operator, which is why they map onto ORGANIZATION UNITS of the owner organization
+ * rather than onto organizations (#1049 Q3).
+ */
+export declare enum SystemOfRecordPartitionKind {
+    /**
+     * A FIELD on every row carries the partition (Odoo `company_id`, NetSuite `subsidiary`). The only
+     * kind supported today: it is filterable, so the confinement can be PUSHED DOWN and a caller never
+     * receives rows of a partition they may not see.
+     */
+    FIELD = "field",
+    /**
+     * The partition is a PATH SEGMENT of the request (Business Central's `/companies({id})/customers`).
+     *
+     * Declared so a facet can be HONEST about a vendor this engine cannot confine yet, and refused by
+     * name where a partition is opted into. A path segment is chosen before the request is built, so it
+     * cannot express "these three companies" in one read — the confinement would have to fan out into
+     * one request per unit, which is a different mechanism rather than a different predicate.
+     */
+    PATH_SEGMENT = "path-segment"
+}
+/**
+ * The SHAPE a partition value arrives in — the difference between a number and a pair.
+ *
+ * Odoo answers a many2one as `[id, display_name]`: `company_id: [10, "Acme"]` on a read, and `false`
+ * when unset. A reader that took the whole array as the key would match nothing, and one that took
+ * `row.company_id` as a scalar would stamp `"10,Acme"`. The shape is declared because the engine
+ * cannot tell a pair from a two-element list by looking.
+ *
+ * spec-cite: Odoo 18.0 developer documentation, "External API" — a many2one is returned as an
+ * `[id, display_name]` pair under both *Read records* and *Search and read*.
+ */
+export declare enum SystemOfRecordPartitionValueShape {
+    /** The field holds the key directly (an integer, a GUID, a string). */
+    SCALAR = "scalar",
+    /** Odoo's many2one: `[id, label]`, and `false` when unset. The id is the key. */
+    MANY2ONE_PAIR = "many2one-pair"
+}
+/**
+ * What a vendor's partitioning IS — declared by the FACET, opted into by the INSTANCE.
+ *
+ * The split is the same one every other vendor fact takes: how a vendor partitions is a property of
+ * the vendor, and WHETHER this deployment's data is partitioned is a property of the deployment. A
+ * single-company Odoo has a `company_id` on every row and nothing to confine.
+ */
+export declare const SystemOfRecordPartitionSupportSchema: z.ZodObject<{
+    kind: z.ZodEnum<typeof SystemOfRecordPartitionKind>;
+    /** The remote field carrying the partition key (`company_id`, `subsidiary`, `CompanyCode`). */
+    remoteField: z.ZodString;
+    /**
+     * How a key is spelled on the wire. Reused from the KEY component vocabulary rather than given its
+     * own: a partition key is addressed exactly as a key component is — decoded from an operator's
+     * authored string, compiled into a remote predicate — and two vocabularies for one job would drift.
+     */
+    codec: z.ZodEnum<typeof HttpApiKeyComponentCodec>;
+    valueShape: z.ZodEnum<typeof SystemOfRecordPartitionValueShape>;
+}, z.core.$strict>;
+export type SystemOfRecordPartitionSupport = z.infer<typeof SystemOfRecordPartitionSupportSchema>;
+/**
+ * What a vendor is, as a system of record. Parsed rather than trusted because #1057 lets a PACKAGE
+ * ship one — a record produced by one package version and read by another.
+ */
+export declare const SystemOfRecordVendorFacetSchema: z.ZodObject<{
+    /** The vendor's stable identifier, named by an instance's `vendor`. Same charset law as an instance name. */
+    vendor: z.ZodString;
+    /**
+     * The dialects this vendor can be READ through. An instance's `dialect` must be one of them, and
+     * a binding's `dialect` must equal its instance's — both refused at boot registration, where the
+     * declaration and the facet are finally in the same scope.
+     */
+    dialects: z.ZodArray<z.ZodEnum<typeof HttpApiTransportDialect>>;
+    /**
+     * The vendor's own address slots — non-secret, authored per instance in the infra env config. The
+     * base URL is registration-scoped and is never credential material.
+     */
+    addressSlots: z.ZodArray<z.ZodObject<{
+        /**
+         * lowerCamelCase, and nothing else — see the module header. Becomes the `<SLOT>` half of
+         * `WILDO_SOR_<NAME>__<SLOT>` by upper-snake-casing.
+         */
+        slug: z.ZodString;
+        /**
+         * Whether an instance MUST supply it. A missing required slot refuses at `wildo config sync` and
+         * again at boot (#1055 E4) — the remedy is authoring a value, which needs no running companion,
+         * so refusing is legitimate there.
+         */
+        required: z.ZodBoolean;
+        /** What an operator must put in it. Printed by sync and by the secrets report. */
+        description: z.ZodString;
+    }, z.core.$strict>>;
+    /**
+     * The credential kinds this vendor offers, each carrying THIS vendor's policy for it. The instance
+     * chooses one kind; a kind no offer names is refused.
+     *
+     * Reshaped from a bare `credentialKinds: Kind[]` in #1056. A list of kinds could say that a vendor
+     * accepts a header-borne API key and could not say WHICH header — so either the operator was asked
+     * (a question the vendor already answers, `derive-before-you-ask.md`) or the engine guessed. An
+     * offer is the kind and its vendor policy as one indivisible thing.
+     */
+    credentialOffers: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.ODOO_API_KEY_IN_ARGS>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.API_KEY_HEADER>>;
+        /** The header the key travels in — `Authorization`, `X-API-Key`, `apikey`, whatever the vendor reads. */
+        headerName: z.ZodString;
+        /** What precedes the key in the header value, INCLUDING its trailing space (`"Bearer "`). Omitted when the key stands alone. */
+        valuePrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.API_KEY_QUERY>>;
+        /** The query parameter the key is appended as. */
+        parameterName: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.BASIC>>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_SECRET>>;
+        clientAuthentication: z.ZodEnum<typeof SystemOfRecordClientAuthenticationPlacement>;
+        tokenLifetimeFallbackSeconds: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.OAUTH2_CLIENT_CREDENTIALS_CERTIFICATE>>;
+        assertionHeaderPolicy: z.ZodEnum<typeof SystemOfRecordAssertionHeaderPolicy>;
+        assertionSigningAlgorithm: z.ZodEnum<typeof SystemOfRecordAssertionSigningAlgorithm>;
+        /** How long the ASSERTION is valid — minutes, not hours; it is consumed once at the token endpoint. */
+        assertionLifetimeSeconds: z.ZodNumber;
+        tokenLifetimeFallbackSeconds: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodLiteral<SystemOfRecordCredentialKind.OAUTH2_JWT_BEARER>>;
+        assertionSigningAlgorithm: z.ZodEnum<typeof SystemOfRecordAssertionSigningAlgorithm>;
+        assertionLifetimeSeconds: z.ZodNumber;
+        tokenLifetimeFallbackSeconds: z.ZodNumber;
+    }, z.core.$strict>], "kind">>;
+    /**
+     * How a COLLECTION READ pages against this vendor (#1292). Meaningful only for the OData dialects.
+     *
+     * OPTIONAL rather than defaulted, and the difference is not cosmetic: `.default()` would make the
+     * field REQUIRED on the parsed type, so every facet — Odoo's JSON-RPC included — would have to
+     * state an answer to a question about a dialect it does not speak. Absent means "not an OData
+     * concern, or the conformant default", and {@link resolveSystemOfRecordODataListPaging} is the one
+     * place that turns absence into `SKIP`.
+     */
+    odataListPaging: z.ZodOptional<z.ZodEnum<typeof SystemOfRecordODataListPaging>>;
+    /**
+     * How this vendor partitions one deployment's data (#1058), when it does.
+     *
+     * ABSENT means the vendor has no partition concept the engine can confine on — which is a real
+     * answer rather than an unfinished one, and the reason an instance opting into `partition` against
+     * such a facet is refused by name rather than silently doing nothing.
+     */
+    partition: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodEnum<typeof SystemOfRecordPartitionKind>;
+        /** The remote field carrying the partition key (`company_id`, `subsidiary`, `CompanyCode`). */
+        remoteField: z.ZodString;
+        /**
+         * How a key is spelled on the wire. Reused from the KEY component vocabulary rather than given its
+         * own: a partition key is addressed exactly as a key component is — decoded from an operator's
+         * authored string, compiled into a remote predicate — and two vocabularies for one job would drift.
+         */
+        codec: z.ZodEnum<typeof HttpApiKeyComponentCodec>;
+        valueShape: z.ZodEnum<typeof SystemOfRecordPartitionValueShape>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type SystemOfRecordVendorFacet = z.infer<typeof SystemOfRecordVendorFacetSchema>;
+/** @wildo_source:part:end saas.models.systems-of-record */
+/**
+ * How this vendor pages an OData collection read — the ONE place an absent declaration becomes an
+ * answer (#1292).
+ *
+ * `$skip` is what OData v4 defines and what a conformant service serves, so silence means the
+ * conformant behaviour rather than an unknown. A second `?? SKIP` written at a consumer is how two
+ * readers come to disagree about what silence meant.
+ */
+export declare function resolveSystemOfRecordODataListPaging(facet: SystemOfRecordVendorFacet): SystemOfRecordODataListPaging;
+/** Every slot ONE instance must supply, once its facet and its credential kind are both known. */
+export interface SystemOfRecordInstanceSlots {
+    readonly addressSlots: readonly SystemOfRecordSlot[];
+    readonly secretSlots: readonly SystemOfRecordSlot[];
+}
+/**
+ * Find the offer a vendor makes for one kind, or `undefined`.
+ *
+ * Separate from {@link resolveSystemOfRecordInstanceSlots} because the two answer different
+ * questions: this one is "what is this vendor's POLICY for the kind I chose", which the minter needs
+ * at every call, while the slot union is a boot-time question asked once.
+ */
+export declare function findSystemOfRecordCredentialOffer(facet: SystemOfRecordVendorFacet, credentialKind: SystemOfRecordCredentialKind): SystemOfRecordCredentialOffer | undefined;
+/**
+ * The ONE place the vendor's slots and the credential kind's slots are joined.
+ *
+ * Every reader of "what does this instance need" goes through here — the environment-variable
+ * derivation, `wildo config sync`'s coherence check, the k8s secrets generator, the CI collector
+ * and the backend registry. Four of those five live in different packages, which is precisely why
+ * re-deriving the union at each of them would drift (`invariant-call-site-enumeration.md`).
+ *
+ * ## It also applies the offer's REQUIRED-NESS, which is why it takes a facet and not a contract
+ *
+ * Three slots are declared optional in the contract map and become required here, because only the
+ * vendor's offer knows: `certificateKeyId` under the key-id assertion header policy, `certificatePem`
+ * under the thumbprint policy, and `subject` for the JWT-bearer grant. Declaring them required in the
+ * contract would make every certificate vendor supply both halves of a choice only one of them makes;
+ * leaving them optional everywhere would let an instance boot with an assertion it cannot build, and
+ * fail at the first read instead of at configuration.
+ *
+ * Throws when the kind is not one the facet offers: that pairing is chosen by an instance and
+ * refused where the instance is validated, so reaching here with it means a caller skipped the
+ * check rather than an operator wrote something wrong.
+ */
+export declare function resolveSystemOfRecordInstanceSlots(facet: SystemOfRecordVendorFacet, credentialKind: SystemOfRecordCredentialKind): SystemOfRecordInstanceSlots;
+//# sourceMappingURL=system-of-record-facet.shared.schemas.d.ts.map

package/dist/esm/systems-of-record/system-of-record-facet.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-of-record-facet.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/systems-of-record/system-of-record-facet.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAGH,OAAO,0BAA0B,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,uDAAuD,CAAC;AAChG,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAC/F,OAAO,EAAE,4BAA4B,EAAE,MAAM,2CAA2C,CAAC;AAGzF,6GAA6G;AAE7G;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;IACnC;;;OAGG;;IAWH;;;;OAIG;;IAEH,kFAAkF;;kBAElF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAuB1E;;;;;;;;GAQG;AACH,eAAO,MAAM,0CAA0C;;QAvDrD;;;WAGG;;QAWH;;;;WAIG;;QAEH,kFAAkF;;;;QApBlF;;;WAGG;;QAWH;;;;WAIG;;QAEH,kFAAkF;;;kBAsClF,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,0CAA0C,EAAE,QAAQ,CAAC,MAAM,CAAC,4BAA4B,EAAE,oCAAoC,CAAC,CA2H3I,CAAC;AAEF;;;;;GAKG;AACH,oBAAY,mCAAmC;IAC7C,+FAA+F;IAC/F,eAAe,oBAAoB;IACnC;;;;;;;OAOG;IACH,uBAAuB,4BAA4B;CACpD;AAED;;;;;;GAMG;AACH,oBAAY,2CAA2C;IACrD,0EAA0E;IAC1E,YAAY,iBAAiB;IAC7B,kEAAkE;IAClE,YAAY,iBAAiB;CAC9B;AAED;;;;GAIG;AACH,oBAAY,uCAAuC;IACjD,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;IACf,KAAK,UAAU;CAChB;AAYD;;;;;;;;GAQG;AACH,eAAO,MAAM,mCAAmC;;;;IAK5C,yGAAyG;;IAEzG,gIAAgI;;;;IAMhI,kDAAkD;;;;;;;;;;;;IAgBlD,uGAAuG;;;;;;;;4BAWzG,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;;;;;;GAYG;AACH,oBAAY,6BAA6B;IACvC;;;;OAIG;IACH,IAAI,SAAS;IACb;;;;;;OAMG;IACH,cAAc,mBAAmB;CAClC;AAED;;;;;;;GAOG;AACH,oBAAY,2BAA2B;IACrC;;;;OAIG;IACH,KAAK,UAAU;IACf;;;;;;;OAOG;IACH,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;GAUG;AACH,oBAAY,iCAAiC;IAC3C,uEAAuE;IACvE,MAAM,WAAW;IACjB,iFAAiF;IACjF,aAAa,kBAAkB;CAChC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC;;IAE/C,+FAA+F;;IAE/F;;;;OAIG;;;kBAGH,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;GAGG;AACH,eAAO,MAAM,+BAA+B;IAC1C,6GAA6G;;IAE7G;;;;OAIG;;IAEH;;;OAGG;;QAlbH;;;WAGG;;QAWH;;;;WAIG;;QAEH,kFAAkF;;;IAgalF;;;;;;;;OAQG;;;;;QA/JD,yGAAyG;;QAEzG,gIAAgI;;;;QAMhI,kDAAkD;;;;;;;;;;;;QAgBlD,uGAAuG;;;;;;;;;IAyIzG;;;;;;;;OAQG;;IAEH;;;;;;OAMG;;;QAxDH,+FAA+F;;QAE/F;;;;WAIG;;;;kBAsFH,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,2DAA2D;AAE3D;;;;;;;GAOG;AACH,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,yBAAyB,GAAG,6BAA6B,CAEpH;AAED,kGAAkG;AAClG,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACrD;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,yBAAyB,EAChC,cAAc,EAAE,4BAA4B,GAC3C,6BAA6B,GAAG,SAAS,CAE3C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,yBAAyB,EAChC,cAAc,EAAE,4BAA4B,GAC3C,2BAA2B,CAmB7B"}